Commit graph

227789 commits

Author SHA1 Message Date
Tejun Heo
1a112d10f0 libata: introduce ata_host->n_tags to avoid oops on SAS controllers
1871ee134b ("libata: support the ata host which implements a queue
depth less than 32") directly used ata_port->scsi_host->can_queue from
ata_qc_new() to determine the number of tags supported by the host;
unfortunately, SAS controllers doing SATA don't initialize ->scsi_host
leading to the following oops.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
 IP: [<ffffffff814e0618>] ata_qc_new_init+0x188/0x1b0
 PGD 0
 Oops: 0002 [#1] SMP
 Modules linked in: isci libsas scsi_transport_sas mgag200 drm_kms_helper ttm
 CPU: 1 PID: 518 Comm: udevd Not tainted 3.16.0-rc6+ #62
 Hardware name: Intel Corporation S2600CO/S2600CO, BIOS SE5C600.86B.02.02.0002.122320131210 12/23/2013
 task: ffff880c1a00b280 ti: ffff88061a000000 task.ti: ffff88061a000000
 RIP: 0010:[<ffffffff814e0618>]  [<ffffffff814e0618>] ata_qc_new_init+0x188/0x1b0
 RSP: 0018:ffff88061a003ae8  EFLAGS: 00010012
 RAX: 0000000000000001 RBX: ffff88000241ca80 RCX: 00000000000000fa
 RDX: 0000000000000020 RSI: 0000000000000020 RDI: ffff8806194aa298
 RBP: ffff88061a003ae8 R08: ffff8806194a8000 R09: 0000000000000000
 R10: 0000000000000000 R11: ffff88000241ca80 R12: ffff88061ad58200
 R13: ffff8806194aa298 R14: ffffffff814e67a0 R15: ffff8806194a8000
 FS:  00007f3ad7fe3840(0000) GS:ffff880627620000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000058 CR3: 000000061a118000 CR4: 00000000001407e0
 Stack:
  ffff88061a003b20 ffffffff814e96e1 ffff88000241ca80 ffff88061ad58200
  ffff8800b6bf6000 ffff880c1c988000 ffff880619903850 ffff88061a003b68
  ffffffffa0056ce1 ffff88061a003b48 0000000013d6e6f8 ffff88000241ca80
 Call Trace:
  [<ffffffff814e96e1>] ata_sas_queuecmd+0xa1/0x430
  [<ffffffffa0056ce1>] sas_queuecommand+0x191/0x220 [libsas]
  [<ffffffff8149afee>] scsi_dispatch_cmd+0x10e/0x300
  [<ffffffff814a3bc5>] scsi_request_fn+0x2f5/0x550
  [<ffffffff81317613>] __blk_run_queue+0x33/0x40
  [<ffffffff8131781a>] queue_unplugged+0x2a/0x90
  [<ffffffff8131ceb4>] blk_flush_plug_list+0x1b4/0x210
  [<ffffffff8131d274>] blk_finish_plug+0x14/0x50
  [<ffffffff8117eaa8>] __do_page_cache_readahead+0x198/0x1f0
  [<ffffffff8117ee21>] force_page_cache_readahead+0x31/0x50
  [<ffffffff8117ee7e>] page_cache_sync_readahead+0x3e/0x50
  [<ffffffff81172ac6>] generic_file_read_iter+0x496/0x5a0
  [<ffffffff81219897>] blkdev_read_iter+0x37/0x40
  [<ffffffff811e307e>] new_sync_read+0x7e/0xb0
  [<ffffffff811e3734>] vfs_read+0x94/0x170
  [<ffffffff811e43c6>] SyS_read+0x46/0xb0
  [<ffffffff811e33d1>] ? SyS_lseek+0x91/0xb0
  [<ffffffff8171ee29>] system_call_fastpath+0x16/0x1b
 Code: 00 00 00 88 50 29 83 7f 08 01 19 d2 83 e2 f0 83 ea 50 88 50 34 c6 81 1d 02 00 00 40 c6 81 17 02 00 00 00 5d c3 66 0f 1f 44 00 00 <89> 14 25 58 00 00 00

Fix it by introducing ata_host->n_tags which is initialized to
ATA_MAX_QUEUE - 1 in ata_host_init() for SAS controllers and set to
scsi_host_template->can_queue in ata_host_register() for !SAS ones.
As SAS hosts are never registered, this will give them the same
ATA_MAX_QUEUE - 1 as before.  Note that we can't use
scsi_host->can_queue directly for SAS hosts anyway as they can go
higher than the libata maximum.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mike Qiu <qiudayu@linux.vnet.ibm.com>
Reported-by: Jesse Brandeburg <jesse.brandeburg@gmail.com>
Reported-by: Peter Hurley <peter@hurleysoftware.com>
Reported-by: Peter Zijlstra <peterz@infradead.org>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Fixes: 1871ee134b ("libata: support the ata host which implements a queue depth less than 32")
Cc: Kevin Hao <haokexin@gmail.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: stable@vger.kernel.org
2014-07-23 10:30:34 -04:00
Chris Wilson
eedd10f45b drm/i915: Simplify i915_gem_release_all_mmaps()
An object can only have an active gtt mapping if it is currently bound
into the global gtt. Therefore we can simply walk the list of all bound
objects and check the flag upon those for an active gtt mapping.

From commit 48018a57a8
Author: Paulo Zanoni <paulo.r.zanoni@intel.com>
Date:   Fri Dec 13 15:22:31 2013 -0200

    drm/i915: release the GTT mmaps when going into D3

Also note that the WARN is inappropriate for this function as GPU
activity is orthogonal to GTT mmap status. Rather it is the caller that
relies upon this condition and so it should assert that the GPU is idle
itself.

References: https://bugs.freedesktop.org/show_bug.cgi?id=80081
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
Tested-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
[danvet: cherry-pick from -next to -fixes.]
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-07-23 16:09:51 +02:00
Florian Fainelli
474ea9cafc net: bcmgenet: correctly pad short packets
Packets shorter than ETH_ZLEN were not padded with zeroes, hence leaking
potentially sensitive information. This bug has been present since the
driver got accepted in commit 1c1008c793
("net: bcmgenet: add main driver file").

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-22 19:59:19 -07:00
John W. Linville
0eeb315b20 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes 2014-07-22 12:49:22 -04:00
Christian König
5b75327563 drm/radeon: fix error handling in radeon_vm_bo_set_addr
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-22 12:21:58 -04:00
Hugh Dickins
88b9828735 drm/i915: fix freeze with blank screen booting highmem
x86_64 boots and displays fine, but booting x86_32 with CONFIG_HIGHMEM
has frozen with a blank screen throughout 3.16-rc on this ThinkPad T420s,
with i915 generation 6 graphics.

Fix 9d0a6fa6c5 ("drm/i915: add render state initialization"): kunmap()
takes struct page * argument, not virtual address.  Which the compiler
kindly points out, if you use the appropriate u32 *batch, instead of
silencing it with a void *.

Why did bisection lead decisively to nearby 229b0489aa ("drm/i915:
add null render states for gen6, gen7 and gen8")?  Because the u32
deposited at that virtual address by the previous stub failed the
PageHighMem test, and so did no harm.

Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-07-22 08:10:36 +02:00
Linus Torvalds
15ba2236f3 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Null termination fix in dns_resolver got the pointer dereferncing
    wrong, fix from Ben Hutchings.

 2) ip_options_compile() has a benign but real buffer overflow when
    parsing options.  From Eric Dumazet.

 3) Table updates can crash in netfilter's nftables if none of the state
    flags indicate an actual change, from Pablo Neira Ayuso.

 4) Fix race in nf_tables dumping, also from Pablo.

 5) GRE-GRO support broke the forwarding path because the segmentation
    state was not fully initialized in these paths, from Jerry Chu.

 6) sunvnet driver leaks objects and potentially crashes on module
    unload, from Sowmini Varadhan.

 7) We can accidently generate the same handle for several u32
    classifier filters, fix from Cong Wang.

 8) Several edge case bug fixes in fragment handling in xen-netback,
    from Zoltan Kiss.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (21 commits)
  ipv4: fix buffer overflow in ip_options_compile()
  batman-adv: fix TT VLAN inconsistency on VLAN re-add
  batman-adv: drop QinQ claim frames in bridge loop avoidance
  dns_resolver: Null-terminate the right string
  xen-netback: Fix pointer incrementation to avoid incorrect logging
  xen-netback: Fix releasing header slot on error path
  xen-netback: Fix releasing frag_list skbs in error path
  xen-netback: Fix handling frag_list on grant op error path
  net_sched: avoid generating same handle for u32 filters
  net: huawei_cdc_ncm: add "subclass 3" devices
  net: qmi_wwan: add two Sierra Wireless/Netgear devices
  wan/x25_asy: integer overflow in x25_asy_change_mtu()
  net: ppp: fix creating PPP pass and active filters
  net/mlx4_en: cq->irq_desc wasn't set in legacy EQ's
  sunvnet: clean up objects created in vnet_new() on vnet_exit()
  r8169: Enable RX_MULTI_EN for RTL_GIGA_MAC_VER_40
  net-gre-gro: Fix a bug that breaks the forwarding path
  netfilter: nf_tables: 64bit stats need some extra synchronization
  netfilter: nf_tables: set NLM_F_DUMP_INTR if netlink dumping is stale
  netfilter: nf_tables: safe RCU iteration on list when dumping
  ...
2014-07-21 22:46:01 -07:00
Linus Torvalds
1486771961 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide
Pull IDE fixes from David Miller:
 - fix interrupt registry for some Atari IDE chipsets.
 - adjust Kconfig dependencies for x86_32 specific chips.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide:
  ide: Fix SC1200 dependencies
  ide: Fix CS5520 and CS5530 dependencies
  m68k/atari - ide: do not register interrupt if host->get_lock is set
2014-07-21 22:44:24 -07:00
Dave Airlie
ec8a362f2e Merge branch 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
* 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/TN: only enable bapm on MSI systems
  drm/radeon: fix VM IB handling
  drm/radeon: fix handling of radeon_vm_bo_rmv v3
  drm/radeon: let's use GB for vm_size (v2)
2014-07-22 10:44:10 +10:00
Jes Sorensen
92e396270f staging: rtl8723au: rtw_resume(): release semaphore before exit on error
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-21 12:10:26 -07:00
Linus Torvalds
67dd8f35c2 Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
 "A series of driver fixes:
   - fix DVB-S tuning with tda1071
   - fix tuner probe on af9035 when the device has a bad eeprom
   - some fixes for the new si2168/2157 drivers
   - one Kconfig build fix (for omap4iss)
   - fixes at vpif error path
   - don't lock saa7134 ioctl at driver's base core level, as it now
     uses V4L2 and VB2 locking schema
   - fix audio at hdpvr driver
   - fix the aspect ratio at the digital timings table
   - one new USB ID (at gspca_pac7302): Genius i-Look 317 webcam"

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] gspca_pac7302: Add new usb-id for Genius i-Look 317
  [media] tda10071: fix returned symbol rate calculation
  [media] tda10071: fix spec inversion reporting
  [media] tda10071: add missing DVB-S2/PSK-8 FEC AUTO
  [media] tda10071: force modulation to QPSK on DVB-S
  [media] hdpvr: fix two audio bugs
  [media] davinci: vpif: missing unlocks on error
  [media] af9035: override tuner id when bad value set into eeprom
  [media] saa7134: use unlocked_ioctl instead of ioctl
  [media] media: v4l2-core: v4l2-dv-timings.c: Cleaning up code wrong value used in aspect ratio
  [media] si2168: firmware download fix
  [media] si2157: add one missing parenthesis
  [media] si2168: add one missing parenthesis
  [media] staging: tighten omap4iss dependencies
2014-07-21 11:44:34 -07:00
Linus Torvalds
6890ad4b38 Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block fixes from Jens Axboe:
 "Final block fixes for 3.16

  Four small fixes that should go into 3.16, have been queued up for a
  bit and delayed due to vacation and other euro duties.  But here they
  are.  The pull request contains:

   - Fix for a reported crash with shared tagging on SCSI from Christoph

   - A regression fix for drbd.  From Lars Ellenberg.

   - Hooking up the compat ioctl for BLKZEROOUT, which requires no
     translation.  From Mikulas.

- A fix for a regression where we woud crash on queue exit if the
  root_blkg is gone/not there. From Tejun"

* 'for-linus' of git://git.kernel.dk/linux-block:
  block: provide compat ioctl for BLKZEROOUT
  blkcg: don't call into policy draining if root_blkg is already gone
  drbd: fix regression 'out of mem, failed to invoke fence-peer helper'
  block: don't assume last put of shared tags is for the host
2014-07-21 11:31:17 -07:00
Linus Torvalds
d6e6c48e5d Merge branch 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata
Pull libata fixes from Tejun Heo:
 "Late libata fixes.

  The most important one is from Kevin Hao which makes sure that libata
  only allocates tags inside the max tag number the controller supports.
  libata always had this problem but the recent tag allocation change
  and addition of support for sata_fsl which only supports queue depth
  of 16 exposed the issue.

  Hans de Goede agreed to become the maintainer of libahci_platform
  which is under higher than usual development pressure from all the new
  controllers popping up from the ARM world"

* 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode)
  drivers/ata/pata_ep93xx.c: use signed int type for result of platform_get_irq()
  libata: EH should handle AMNF error condition as a media error
  libata: support the ata host which implements a queue depth less than 32
  MAINTAINERS: Add Hans de Goede as ahci-platform maintainer
2014-07-21 11:25:44 -07:00
Linus Torvalds
80d6191ea7 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
 "A couple of last minute bug fixes for 3.16, including a fix for ptrace
  to close a hole which allowed a user space program to write to the
  kernel address space"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: fix restore of invalid floating-point-control
  s390/zcrypt: improve device probing for zcrypt adapter cards
  s390/ptrace: fix PSW mask check
  s390/MSI: Use standard mask and unmask funtions
  s390/3270: correct size detection with the read-partition command
  s390: require mvcos facility, not tod clock steering facility
2014-07-21 11:18:31 -07:00
Greg Kroah-Hartman
1f31c3f0e1 Fifth set of fixes for IIO in the 3.16 cycle.
One nasty one that has been around a long time and a couple of non compliant
 ABI fixes.
 
 * The demux code used to split out desired channels for devices that only
   support reading sets of channels at one time had a bug where it was
   building it's conversion tables against the wrong bitmap resulting in
   it never actually demuxing anything.  This is an old bug, but will be
   effecting an increasing number of drivers as it is often used to avoid
   some fiddly code in the individual drivers.
 
 * bma180 and mma8452 weren't obeying the ABI wrt to units for acceleration.
   Were in G rather than m/s^2. A little input check was missing from bma180
   that might lead to acceptance of incorrect values.  This last one is minor
   but might lead to incorrect userspace code working and problems in the
   future.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJTzA9MAAoJEFSFNJnE9BaI+kgP/RuIbx7zMGEZC0G1o3suKcgk
 2N4SyUhrnz0MvX7HyckpLlAFr5YU1l5sRvBi+RW9NRtAjbZcRH7c3uc8AqptWIuF
 DuqNCM/WLSOEsFWV8kRzClKcTBwz1O59cAtR1jNz7r6CsmehPDQljhRW/wg6+v5h
 MvYr4zvgsVbaT+x6/iGnJUIMnEcsPiwRfbmyXkPa9uvv6KFixiG3NUEz1maeRJ/T
 a9Xpvl/T4Bl+0dhS0kIMYC4tInUdfG4HygJeUTLxVOsDkrpHKn2x23Peco1UpAUd
 4k1cNDUzUzQHYH8kKi+j8N7MQdLvVS2NbJ4lwcR6zME57ocvXYZ8nVrjRWWonnON
 BkYRdmXQrDUes7d1A+0s3x8LDJf0jCHvBqqkmLqMe7F1BiOhQfbV5Mm/nrxHIWBJ
 ssW0V5t9jxZDdt4IBEOA8DaqSxNeyqdHJPMMysvBxfvOtxmCVlU2QEwW8Sy3J54k
 K1YHqfoefDbZpPGVT78B7eBVr7PgE5H4Btuz6hulSo1f5w13l1eVcRO7PHBCCKQQ
 /9pSLaGQekTuZSFQVHPJoqlFmHh9r70pkvzPezEdqhURdYgR+vWGYPCPJ63X6Y9h
 7unl5tvVLU0vvuEaUVo4BemnpfniNuEVsASp1KIjTF6fpM3MjgVmOOPY0pfLEgxa
 86ztLa8DGsO1oz0HgGwJ
 =Q+s/
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-3.16e' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

Jonathan writes:

Fifth set of fixes for IIO in the 3.16 cycle.

One nasty one that has been around a long time and a couple of non compliant
ABI fixes.

* The demux code used to split out desired channels for devices that only
  support reading sets of channels at one time had a bug where it was
  building it's conversion tables against the wrong bitmap resulting in
  it never actually demuxing anything.  This is an old bug, but will be
  effecting an increasing number of drivers as it is often used to avoid
  some fiddly code in the individual drivers.

* bma180 and mma8452 weren't obeying the ABI wrt to units for acceleration.
  Were in G rather than m/s^2. A little input check was missing from bma180
  that might lead to acceptance of incorrect values.  This last one is minor
  but might lead to incorrect userspace code working and problems in the
  future.
2014-07-21 10:58:51 -07:00
Chris Wilson
a0d036b074 drm/i915: Reorder the semaphore deadlock check, again
commit 4be173813e
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jun 6 10:22:29 2014 +0100

    drm/i915: Reorder semaphore deadlock check

did the majority of the work, but it missed one crucial detail:

The check for the unkickable deadlock on this ring must come after the
check whether the ring that we are waiting on has already passed its
target seqno.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=80709
Tested-by: Stefan Huber <shuber@sthu.org>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-07-21 19:29:49 +02:00
Alex Deucher
730a336c33 drm/radeon/TN: only enable bapm on MSI systems
There still seem to be stability problems with other systems.

Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=72921

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-21 13:17:39 -04:00
Christian König
cc9e67e3d7 drm/radeon: fix VM IB handling
Calling radeon_vm_bo_find on the IB BO during CS
is illegal and can lead to an crash.

Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-21 13:17:38 -04:00
Christian König
036bf46a39 drm/radeon: fix handling of radeon_vm_bo_rmv v3
v3: completely rewritten. We now just remember which areas
    of the PT to clear and do so on the next command submission.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=79980

Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-21 13:17:38 -04:00
Christian König
20b2656d7e drm/radeon: let's use GB for vm_size (v2)
VM sizes smaller than 1GB doesn't make much sense anyway.

v2: fix typo and grammer

Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-21 13:17:37 -04:00
Eliad Peller
4601879419 iwlwifi: mvm: pass beacons from foreign APs
In AP mode, configure the fw to pass beacons from
foreign APs, in order to be able to set the ht
protection IE properly.

Add the same filters in case of GO (which didn't have
any configured filter_flags, probably by mistake)

Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2014-07-21 10:38:25 +03:00
Zoltan Kiss
d8cfbfc466 xen-netback: Fix pointer incrementation to avoid incorrect logging
Due to this pointer is increased prematurely, the error log contains rubbish.

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Reported-by: Armin Zentai <armin.zentai@ezit.hu>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-20 20:56:06 -07:00
Zoltan Kiss
1b860da040 xen-netback: Fix releasing header slot on error path
This patch makes this function aware that the first frag and the header might
share the same ring slot. That could happen if the first slot is bigger than
PKT_PROT_LEN. Due to this the error path might release that slot twice or never,
depending on the error scenario.
xenvif_idx_release is also removed from xenvif_idx_unmap, and called separately.

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Reported-by: Armin Zentai <armin.zentai@ezit.hu>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-20 20:56:06 -07:00
Zoltan Kiss
b42cc6e421 xen-netback: Fix releasing frag_list skbs in error path
When the grant operations failed, the skb is freed up eventually, and it tries
to release the frags, if there is any. For the main skb nr_frags is set to 0 to
avoid this, but on the frag_list it iterates through the frags array, and tries
to call put_page on the page pointer which contains garbage at that time.

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Reported-by: Armin Zentai <armin.zentai@ezit.hu>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-20 20:56:06 -07:00
Zoltan Kiss
1a998d3e6b xen-netback: Fix handling frag_list on grant op error path
The error handling for skb's with frag_list was completely wrong, it caused
double unmap attempts to happen if the error was on the first skb. Move it to
the right place in the loop.

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Reported-by: Armin Zentai <armin.zentai@ezit.hu>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-20 20:56:05 -07:00
Linus Torvalds
b7a68369ea Staging fixes for 3.16-rc6
Here are 2 IIO driver fixes for 3.16-rc6 that resolve some reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlPMHxEACgkQMUfUDdst+ymCLgCfe5O5VyAnDYpmnykiJYFIoKOG
 f50AoJJEPSMi2chNap5zUlcr+XfcALhG
 =VS0g
 -----END PGP SIGNATURE-----

Merge tag 'staging-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull more IIO driver fixes from Greg KH:
 "Here are two IIO driver fixes for 3.16-rc6 that resolve some reported
  issues"

* tag 'staging-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  iio: mma8452: Use correct acceleration units.
  iio:core: Handle error when mask type is not separate
2014-07-20 20:44:53 -07:00
Linus Torvalds
caa7c4e172 USB fixes for 3.16-rc6
Here are 2 USB patches that resolve some reported issues, one with an
 odd HUB, and one in the chipidea driver.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlPMHpMACgkQMUfUDdst+ymQIQCeOK2oC0C5h1P7HHAQ4UiGpSgt
 MHwAoJfAeqF77RajND+m4ds6hwc5h8IF
 =ufek
 -----END PGP SIGNATURE-----

Merge tag 'usb-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are two USB patches that resolve some reported issues, one with
  an odd HUB, and one in the chipidea driver"

* tag 'usb-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: Check if port status is equal to RxDetect
  usb: chipidea: udc: Disable auto ZLP generation on ep0
2014-07-20 20:44:18 -07:00
Linus Torvalds
f47d5bb02e driver core fix for 3.16-rc6
Here is a single driver core fix that reverts an older patch that has
 been causing a number of reported problems with the platform devices.
 
 This revert has been in linux-next for a while with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlPMHSoACgkQMUfUDdst+ymu9QCg0cfc2t+rsUtIO6rPPCRn6ikf
 nT8Anjc5NGwDE4lpKBfyKXX41RsPpUBN
 =+PxC
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core fix from Greg KH:
 "Here is a single driver core fix that reverts an older patch that has
  been causing a number of reported problems with the platform devices.

  This revert has been in linux-next for a while with no reported issues"

* tag 'driver-core-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  platform_get_irq: Revert to platform_get_resource if of_irq_get fails
2014-07-20 20:43:46 -07:00
Linus Torvalds
fa24615f4c char/misc fix for 3.16-rc6
Here's a single hyper-v driver fix for a reported issue.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iEYEABECAAYFAlPMHJ8ACgkQMUfUDdst+ynYSwCcDDBYUiSyLA5K7yGXnzIk1+9A
 Hx0An0px2gQKVAICjZ0toVWmlrAgVGUG
 =vNMw
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc fix from Greg KH:
 "Here's a single hyper-v driver fix for a reported issue"

* tag 'char-misc-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  Drivers: hv: hv_fcopy: fix a race condition for SMP guest
2014-07-20 20:43:14 -07:00
Linus Torvalds
5556ea4df6 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull intel drm fixes from Dave Airlie:
 "Intel fixes came in late, but since I debugged one of them I'll send
  them on,

  Two reverts, a quirk and one warn regression"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  Revert "drm/i915: reverse dp link param selection, prefer fast over wide again"
  drm/i915: Track the primary plane correctly when reassigning planes
  drm/i915: Ignore VBT backlight presence check on HP Chromebook 14
  Revert "drm/i915: Don't set the 8to6 dither flag when not scaling"
2014-07-20 20:39:28 -07:00
Dmitry Torokhov
50c5d36dab Input: fix defuzzing logic
We attempt to remove noise from coordinates reported by devices in
input_handle_abs_event(), unfortunately, unless we were dropping the
event altogether, we were ignoring the adjusted value and were passing
on the original value instead.

Cc: stable@vger.kernel.org
Reviewed-by: Andrew de los Reyes <adlr@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Reviewed-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-07-20 13:17:42 -07:00
Peter Meerwald
9b2a4d35a6 iio:bma180: Missing check for frequency fractional part
val2 should be zero

This will make no difference for correct inputs but will reject
incorrect ones with a decimal part in the value written to the sysfs
interface.

Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Cc: Oleksandr Kravchenko <o.v.kravchenko@globallogic.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Cc: Stable@vger.kernel.org
2014-07-20 17:39:47 +01:00
Peter Meerwald
381676d5e8 iio:bma180: Fix scale factors to report correct acceleration units
The userspace interface for acceleration sensors is documented as using
m/s^2 units [Documentation/ABI/testing/sysfs-bus-iio]

The fullscale raw values for the BMA80 corresponds to -/+ 1, 1.5, 2, etc G
depending on the selected mode.

The scale table was converting to G rather than m/s^2.
Change the scaling table to match the documented interface.

See commit 71702e6e, iio: mma8452: Use correct acceleration units,
for a related fix.

Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Cc: Oleksandr Kravchenko <o.v.kravchenko@globallogic.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Cc: Stable@vger.kernel.org
2014-07-20 17:38:39 +01:00
Lars-Peter Clausen
61bd55ce16 iio: buffer: Fix demux table creation
When creating the demux table we need to iterate over the selected scan mask for
the buffer to get the samples which should be copied to destination buffer.
Right now the code uses the mask which contains all active channels, which means
the demux table contains entries which causes it to copy all the samples from
source to destination buffer one by one without doing any demuxing.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Cc: Stable@vger.kernel.org
2014-07-20 15:44:39 +01:00
Linus Torvalds
cb20fd0779 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull irq fixes from Thomas Gleixner:
 "Three patches addressing shortcomings in the ARM gic interrupt chip
  driver"

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip: gic: Fix core ID calculation when topology is read from DT
  irqchip: gic: Add binding probe for ARM GIC400
  irqchip: gic: Add support for cortex a7 compatible string
2014-07-19 06:26:01 -10:00
Dave Airlie
e898c791e1 Merge tag 'drm-intel-fixes-2014-07-18' of git://anongit.freedesktop.org/drm-intel
But in any case nothing really shocking in
here, 2 reverts, 1 quirk and a regression fix a WARN.

* tag 'drm-intel-fixes-2014-07-18' of git://anongit.freedesktop.org/drm-intel:
  Revert "drm/i915: reverse dp link param selection, prefer fast over wide again"
  drm/i915: Track the primary plane correctly when reassigning planes
  drm/i915: Ignore VBT backlight presence check on HP Chromebook 14
  Revert "drm/i915: Don't set the 8to6 dither flag when not scaling"
2014-07-19 16:48:38 +10:00
Linus Torvalds
1b9f0efd61 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Peter Anvin:
 "A couple of key fixes and a few less critical ones.  The main ones
  are:

   - add a .bss section to the PE/COFF headers when building with EFI
     stub

   - invoke the correct paravirt magic when building the espfix page
     tables

  Unfortunately both of these areas also have at least one additional
  fix each still in thie pipeline, but which are not yet ready to push"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86: Remove unused variable "polling"
  x86/espfix/xen: Fix allocation of pages for paravirt page tables
  x86/efi: Include a .bss section within the PE/COFF headers
  efi: fdt: Do not report an error during boot if UEFI is not available
  efi/arm64: efistub: remove local copy of linux_banner
2014-07-18 20:46:55 -10:00
Linus Torvalds
b579fcca32 InfiniBand/RDMA fixes for 3.16
- cxgb4 hardware driver regression fixes
  - mlx5 hardware driver regression fixes
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABCAAGBQJTyYWiAAoJEENa44ZhAt0hKkMP/ROnFwRtk0DKNGbyZLx/gLpK
 hEvzNeqZKn8OS2eHMvkP+pbKWrm1GoPcPEMZVfZv8dqwS7PzcmHVsA7WjzJF0mXh
 PLuPZfLHu4UZAZttP7Hm8XV+p7uthD/Fvk60x/uzboMZhSjFt4Khb0tEvezZ8Jyh
 5bbkiCp2PokD4z32fFoErTxa5XE8bYuqL70G9YyMuwdZWS2W4WbjihYHbi8vBzFd
 IsAvl4Ms/Fs8B5aeK0beeuals0yLYishPQY/F+r10GUQ3Q3JlD1/5j/MML3SZOlX
 FfYC3BDm3zgVHdaDTohlXbGVvJbziI5xkj0cUxVIk5f3SVZC36/BR+AxtjlhLjvR
 GEh9wwCP1cfXt7tRFBOS11M869oUOjG/5SQozsnJTAztpll85wxIWOyCCupRSokX
 90YNFtdGTBMkkm5vbddpekw+ku/qhrG8oNhKLMXoP1v4nV/8HiVG+oZdzQYrPPOp
 KMkNtC6ItLCXBRF0hUGGAszUaFap0ZFCfWk9d8W+xpOnFzVgE8pkG2kRH1fty5ja
 HbI/0OhiX5x+lYhyzGUb+AnjNTT5yYba1M+t1Sr3JC5AxBzwiS4FYq7TRTnNGt+p
 H6/+WMw+PcCpCaOcVCivbFCl1gceA7bKCMuwjjFoO0CjDT8Tr6pX3gRcDvrxHVGr
 rLi5EcHdgJEsPfaUACbv
 =JbA3
 -----END PGP SIGNATURE-----

Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

Pull infiniband/rdma fixes from Roland Dreier:
 - cxgb4 hardware driver regression fixes
 - mlx5 hardware driver regression fixes

* tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mlx5: Enable "block multicast loopback" for kernel consumers
  RDMA/cxgb4: Call iwpm_init() only once
  mlx5_core: Fix possible race between mr tree insert/delete
  RDMA/cxgb4: Initialize the device status page
  RDMA/cxgb4: Clean up connection on ARP error
  RDMA/cxgb4: Fix skb_leak in reject_cr()
2014-07-18 20:39:34 -10:00
Linus Torvalds
cfd1b99b4a More fallout from module tests and code inspection.
Fixes to temperature limit write operations in adt7470 driver.
 Also, dashes are not allowed in hwmon 'name' attributes.
 Fix drivers where necessary.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTx08gAAoJEMsfJm/On5mBDCkQAIsUQlxbUr6C0B9Sbi+LlMe9
 APEJnxDyUjsPfuykxcD6myPkOKIIVnE3H0zV5c/poiSjCLrgIdFmFcc477OYcdXH
 7zcO7VvlHgh5orLN9OVO3cTKVICPoubdLbSxgnP5Q/4M6N+LAbodIaxJ2+Sw8xco
 j9uw6gKxA8S12ak83u+i2df14P2VQFpXTGfEyTvl8B/1stGq22X8mCEayrQOviep
 Y/h1ZnHAY9PCMIRjW8+jnGR0r8JwKlvOZFdTyd2MlHU0hDtGtjhZxeD6ig4VbWvp
 UWBB5fvWdpGbVd6/c8VpMtOKVPaxcEvRDzekhXXjmdDObJYXz9gWxP9uX00+FpF1
 AmJ9pYw8aOmt7RUY/+WviKG3Z915NtWVAQ7C3HJneDjcE5fLnlidmsQyl9rapYOC
 KW3xBJK667fQNVx/9Mff8guffVt1lmuvw6fhAKL1z3i9M/0Qqk/rHxz3Mx7gsUcf
 4Ul909mqLzZvIZTvwq47ivWg3KX4uV//YtlFDd07+L4j9ZkszI2mxLHj36uXl4m/
 emFm6Xd4UPMm+zyHOkakZcn/z/ae36QRGJ5F7D16qF07rYm4ZjgrhFFSApoGrgSq
 nNrT+iJ/resIm3uukt9OnkszUMFp1Y4NUsYu9MAXEw9Yr6uMWRQZQ3g7e2E1JEte
 AyYhlpcb6lCjP7WO1aWm
 =LmdI
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:
 "More fallout from module tests and code inspection.

  Fixes to temperature limit write operations in adt7470 driver.  Also,
  dashes are not allowed in hwmon 'name' attributes.  Fix drivers where
  necessary"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (adt7470) Fix writes to temperature limit registers
  hwmon: (da9055) Don't use dash in the name attribute
  hwmon: (da9052) Don't use dash in the name attribute
2014-07-18 20:37:24 -10:00
Linus Torvalds
0bae49b24c IOMMU Fixes for Linux v3.16-rc5
A couple of fixes for the Freescale PAMU driver queued up:
 
       * Fix PAMU window size check.
       * Fix the device domain attach condition.
       * Fix the error condition during iommu group
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJTySEjAAoJECvwRC2XARrjgqYP/0sndB7nTd3qXQX64eY8aGZJ
 3NpZPeiBXIqI04HHkkqA+cGMIHVXluI18tqGC8XpW0oV4pVYfgPv645VuNRu7DtJ
 SEO0LECLkPJFqsRdWqasJezGGl7xEYVLtJasbF2SSXzrbaaEuqQGCpwh6hJ8dehX
 EU3qEMIt1wslVszFwHRAiPefONl4+Oa7DLWZOZ9+0cnylLFVtljGKfk599yO/jXL
 2Gq1ehJCOzDfBnpzD95P6wnMdRk5aBid9AbPKl9jzzTmBm5puEYkDY+hpFNGXmz0
 VUnSe3Jnh7B9TcKG6xv4GjAoraGeofQxNNl8HOjxGzAUERaadKXXA0kF4tPURTwm
 OWFpuz/fpLvruDRg0eBZ/FVnup2USNSy4Dr4VG0Zf/FZfRzaWOur1LnAOgFxga9h
 zcWJG2bfN/UiIRkh1ntTyjI2pAlEFc3Hm0bCG81+S/Fza6AM70iX/KSmjcb3RxWm
 Tv//ie5tABxgBoVJz7itYmC2JHsNp2bbKfuijbpOs8tEe6bLZjTMOM6qtbxOJ9JG
 J9gomxE612lt+Zm78rWt2PEuSqohX7zVJntSTrqk6wTmgO20trb+H7ASl6G11lCj
 LgJmyHRgrjVa8+EviWz9IkWh4pgvsr/HHngvNGXNl1cg+6DDypLO6QnrWEqcAqNK
 pNAvi5w/ZGuhPrPXxpWY
 =Xvdu
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v3.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull iommu fixes from Joerg Roedel:
 "A couple of fixes for the Freescale PAMU driver queued up:

   - fix PAMU window size check.
   - fix the device domain attach condition.
   - fix the error condition during iommu group"

* tag 'iommu-fixes-v3.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/fsl: Fix the error condition during iommu group
  iommu/fsl: Fix the device domain attach condition.
  iommu/fsl: Fix PAMU window size check.
2014-07-18 20:36:13 -10:00
Linus Torvalds
084c9cac39 ACPI and power management fixes for 3.16-rc6
- Fix for a recently introduced NULL pointer dereference in the core
    system suspend code occuring when platforms without ACPI attempt to
    use the "freeze" sleep state from Zhang Rui.
 
  - Fix for a recently introduced build warning in cpufreq headers from
    Brian W Hart.
 
  - Fix for a 3.13 cpufreq regression related to sysem resume that
    triggers on some systems with multiple CPU clusters from Viresh Kumar.
 
  - Fix for a 3.4 regression in request_firmware() resulting in
    WARN_ON()s on some systems during system resume from Takashi Iwai.
 
  - Revert of the ACPI video commit that changed the default value of
    the video.brightness_switch_enabled command line argument to 0 as
    it has been reported to break existing setups.
 
  - ACPI device enumeration documentation update to take recent code
    changes into account and make the documentation match the code again
    from Darren Hart.
 
  - Fixes for the sa1110, imx6q, kirkwood, and cpu0 cpufreq drivers
    from Linus Walleij, Nicolas Del Piano, Quentin Armitage, Viresh Kumar.
 
  - New ACPI video blacklist entry for HP ProBook 4540s from Hans de Goede.
 
 /
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABCAAGBQJTyHqVAAoJEILEb/54YlRxsV4P/0wiCc/VDxC614uCRcNVv0mH
 4BtAvhV5Oe32M5MNYrDO4GefRqFSgz6xZ2B55ioTyNML2b7rcXJqlS4r6P6ESlog
 ccwOSsEvMmmOpMRynoQJq9vGybPdhUiA8G4ABeC/Y57MfKEbS58dw9Fi/BXpII+A
 RZOzHPNvzFExkw6bBxO3l66uDTeZPVZQOs5hLRSrxa1s99+E/N4aa99nE26YPR6b
 U15cfuYMigfpziO3k4OtCka3sZYMO0XzVZjH62rJJBwh9G24uTzoL/lcOpLbZyaW
 DGLm/3LoH46WGGIrkIiWKplzhiSQ0BeOzlK9bAX6L11UMLMO0DOtKoZl6H37bS/J
 XLbSpdH22WGaF+QNWu3yPqLOpSZZxjYFQ0u8jDL00EzbIePpx4ynKbfCG2Q+EhcT
 siDpXsC084rznWaYPKAyTitrhrqsWCzuI12BLO5AgJUvQ/jdyGgim8UWLp7AV1K7
 Tc40MJdR7hUpJigg3+ORj88dYJvQXRYifbfTTbmQ0VEf9g5PXV5wLDvWY5Uo99SA
 pYnY+jLcc13K7eDd+dm3MhSiW6H+jvzNq2WCFHqLzCG64Dj11HMHevhIRWEueekY
 fF3JwqDByvj/f4PW8wwqlAnbNzhVEDzkJHHsCXj90KFCoBG3KIKU2G0ISwMbVZkJ
 y9vflHb4Vh/WK9Puyffz
 =kuyY
 -----END PGP SIGNATURE-----

Merge tag 'pm+acpi-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI and power management fixes from Rafael Wysocki:
 "These are a few recent regression fixes, a revert of the ACPI video
  commit I promised, a system resume fix related to request_firmware(),
  an ACPI video quirk for one more Win8-oriented BIOS, an ACPI device
  enumeration documentation update and a few fixes for ARM cpufreq
  drivers.

  Specifics:

   - Fix for a recently introduced NULL pointer dereference in the core
     system suspend code occuring when platforms without ACPI attempt to
     use the "freeze" sleep state from Zhang Rui.

   - Fix for a recently introduced build warning in cpufreq headers from
     Brian W Hart.

   - Fix for a 3.13 cpufreq regression related to sysem resume that
     triggers on some systems with multiple CPU clusters from Viresh
     Kumar.

   - Fix for a 3.4 regression in request_firmware() resulting in
     WARN_ON()s on some systems during system resume from Takashi Iwai.

   - Revert of the ACPI video commit that changed the default value of
     the video.brightness_switch_enabled command line argument to 0 as
     it has been reported to break existing setups.

   - ACPI device enumeration documentation update to take recent code
     changes into account and make the documentation match the code
     again from Darren Hart.

   - Fixes for the sa1110, imx6q, kirkwood, and cpu0 cpufreq drivers
     from Linus Walleij, Nicolas Del Piano, Quentin Armitage, Viresh
     Kumar.

   - New ACPI video blacklist entry for HP ProBook 4540s from Hans de
     Goede"

* tag 'pm+acpi-3.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: make table sentinel macros unsigned to match use
  cpufreq: move policy kobj to policy->cpu at resume
  cpufreq: cpu0: OPPs can be populated at runtime
  cpufreq: kirkwood: Reinstate cpufreq driver for ARCH_KIRKWOOD
  cpufreq: imx6q: Select PM_OPP
  cpufreq: sa1110: set memory type for h3600
  ACPI / video: Add use_native_backlight quirk for HP ProBook 4540s
  PM / sleep: fix freeze_ops NULL pointer dereferences
  PM / sleep: Fix request_firmware() error at resume
  Revert "ACPI / video: change acpi-video brightness_switch_enabled default to 0"
  ACPI / documentation: Remove reference to acpi_platform_device_ids from enumeration.txt
2014-07-18 20:28:27 -10:00
Linus Torvalds
3e8e2756b6 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
 "One nouveau deadlock fix, one qxl irq handling fix, and a set of
  radeon pageflipping changes that fix regressions in pageflipping since
  -rc1 along with a leak and backlight fix.

  The pageflipping fixes are a bit bigger than I'd like, but there has
  been a few people focused on testing them"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: Make classic pageflip completion path less racy.
  drm/radeon: Add missing vblank_put in pageflip ioctl error path.
  drm/radeon: Remove redundant fence unref in pageflip path.
  drm/radeon: Complete page flip even if waiting on the BO fence fails
  drm/radeon: Move pinning the BO back to radeon_crtc_page_flip()
  drm/radeon: Prevent too early kms-pageflips triggered by vblank.
  drm/radeon: set default bl level to something reasonable
  drm/radeon: avoid leaking edid data
  drm/qxl: return IRQ_NONE if it was not our irq
  drm/nouveau/therm: fix a potential deadlock in the therm monitoring code
2014-07-18 20:27:23 -10:00
Linus Torvalds
b8d2d12804 Fix a BUG splat found by trinity.
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJTygXeAAoJENNvdpvBGATwBVYP/3OHIb58JhHjC/GbHKhe0UdX
 eSBle+8bcDdwADXBQ2Slzp7bVBwBHaEgKOz0Y9iTObrICb5orUGtB7MmGi9b9WIW
 8igTkvNhQxwNZat89U5SOpPuwSJEyR9LeIKN8JG75j+ymX/H1vjsojJcXxfZzYT0
 qoiUs32VbmglfVPy1WvPLZ/0fYtaRwzE6des7yzZHYbEvgX5JIJ7m4sQftMj4a+L
 CNiLHXLijsUX9CG94Gjw7R7/PLK83UNM+ER5zUTIC6EqRJCZVIQAU0zvyE5sm3ZK
 v3n8aJypZZhNBGJm4SNWlwsbwllx9BvPOq2DadY+/Jpzqrxy1saYB+XoKKdT3t2Y
 3OJb/eh02wuCzCzJgNNP9CJhdPV7h4qrg5M1OqrBsFgXEAlISLvWEM+//FB8Hsmv
 NDKeWl6Y5Iy6UCZDVQpuYCJTo46ACt0DBLpOE9tXDtz6yuLF+Hs3GmRPz368EcEy
 t98UmU7mS447FQdqjThKdH1g/ZeGepXDMkk/hosmnck7OgQzuLMBnAagwouQ9YSH
 O32MyvGHkAPEL2SB2WzGdWIHr/K2EWiyAoO3OVaUrJ7tVrGvVig/WsgYyNaHzBlp
 5VRCdBXJ78tH+KYl0lIkrzrOnd1AegQtIIH5E3iZsdUVqCM/DdDd5ewwWxC7Ar3s
 PGrT4lp8vqIT0H3D65a5
 =8rgT
 -----END PGP SIGNATURE-----

Merge tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random

Pull /dev/random fix from Ted Ts'o:
 "Fix a BUG splat found by trinity"

* tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
  random: check for increase of entropy_count because of signed conversion
2014-07-18 20:26:46 -10:00
Linus Torvalds
4e10627529 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fixes from Herbert Xu:
 "This push fixes a boot hang in virt guests when the virtio RNG is
  enabled"

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  hwrng: virtio - ensure reads happen after successful probe
  hwrng: fetch randomness only after device init
2014-07-18 20:25:54 -10:00
Hannes Frederic Sowa
79a8468747 random: check for increase of entropy_count because of signed conversion
The expression entropy_count -= ibytes << (ENTROPY_SHIFT + 3) could
actually increase entropy_count if during assignment of the unsigned
expression on the RHS (mind the -=) we reduce the value modulo
2^width(int) and assign it to entropy_count. Trinity found this.

[ Commit modified by tytso to add an additional safety check for a
  negative entropy_count -- which should never happen, and to also add
  an additional paranoia check to prevent overly large count values to
  be passed into urandom_read().  ]

Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
2014-07-19 01:42:13 -04:00
Romain Degez
b32bfc06ae ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode)
Add support of the Promise FastTrak TX8660 SATA HBA in ahci mode by
registering the board in the ahci_pci_tbl[].

Note: this HBA also provide a hardware RAID mode when activated in
BIOS but specific drivers from the manufacturer are required in this
case.

Signed-off-by: Romain Degez <romain.degez@gmail.com>
Tested-by: Romain Degez <romain.degez@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
2014-07-18 18:00:50 -04:00
Bjorn Helgaas
67f4aef200 Input: sirfsoc-onkey - fix GPL v2 license string typo
Per license_is_gpl_compatible(), the MODULE_LICENSE() string for GPL v2 is
"GPL v2", not "GPLv2".  Use "GPL v2" so this module doesn't taint the
kernel.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-07-18 10:19:42 -07:00
Tobias Klauser
2e58cdcc22 Input: st-keyscan - fix 'defined but not used' compiler warnings
Add #ifdef CONFIG_PM_SLEEP around keyscan_supend() and keyscan_resume() to
fix the following compiler warnings occuring if CONFIG_PM_SLEEP is unset:

  + /scratch/kisskb/src/drivers/input/keyboard/st-keyscan.c: warning: 'keyscan_resume' defined but not used [-Wunused-function]:  => 235:12
  + /scratch/kisskb/src/drivers/input/keyboard/st-keyscan.c: warning: 'keyscan_suspend' defined but not used [-Wunused-function]:  => 218:12

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lkml.org/lkml/2014/7/8/109
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2014-07-18 10:18:55 -07:00
Linus Torvalds
55ae1bd0d2 Fix the dm-thinp and dm-cache targets to disallow changing the data
device's block size.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTyIuDAAoJEMUj8QotnQNaKOcH/iC5X88HYBke3myjj8fkQelw
 05b1slxnKDINTE+L2eBzuyqzcNm8jLq02ltf9x8VuTxdzioR353PVWHfEmVkUYhJ
 DSnPPtLrfF+FsoABWEcjYcHyguUusgpZ9su94yctDErJcscgs9+7hJJhNKSCf+cW
 VmthtG4vXOdGP2Fl9IGQIzbGgwVWfT1QZN7yhFX2WGwgpBP4u4a9b4kY+sVQjfuz
 lcqy0/MTrsI63TATaGeiILbWh86BNxaoeCe+gBXMk6uvPBaJkGCo9o4OZjbe0d0f
 8wnedBiew8OlEZJAVEjxm+eNMukjeAcRE4gz/qTyaYlxwOqXQJCbsGyraWxpnXM=
 =ZDsD
 -----END PGP SIGNATURE-----

Merge tag 'dm-3.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fixes from Mike Snitzer:
 "Fix the dm-thinp and dm-cache targets to disallow changing the data
  device's block size"

* tag 'dm-3.16-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm cache metadata: do not allow the data block size to change
  dm thin metadata: do not allow the data block size to change
2014-07-18 06:25:05 -10:00
Linus Torvalds
033ead8230 Two UBI fastmap-related fixes for v3.16:
1. Fix UBI fastmap support which we broke in 3.16-rc1 by reversing the
    volumes RB-tree sorting criteria.
 2. Make sure that we scrub all PEBs where we see bit-flips - we were missing
    some of them when the fastmap feature was enabled.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTyQKqAAoJECmIfjd9wqK0tlMQAMpBzznmZ9SOMR9j5ngyi9bW
 IZH+O5DcihH4ihlXLiUaehRs/0tDWa1YgaRunHhP0oxyWG12BBJWroAz8cr+XR+T
 WtJhUGSCatGeBAsc1ZN57zKHmdJO0SIUHyeLRibSSASTdO0ZS7KojQ1nexpfwGbC
 ydzNzwyA5DBcvzICEe4gAuIgsZ52gKCQuDBPS2YrBFqOmZD2JVDaoFg3yNcVYnhV
 0/qukK9SVJOQDMiVthoalNNqZHTHTNlMo36dXem1q/nWkQ5Y/E7BOUmdMvEv76+u
 UysgNMCoaJnTG5lW0vGptCXdWEcXfc88omrPVPaM6yCx6n0pRB+BVTKQjxZoRhLY
 RWFJkn/tTL623PrsotBfRoZ8BzxUwffDXQvwjLYgGLsUmoopqNc6eb4Hhmjufhbl
 xwmrggon2w2RYKhvFch9Z3St+3Ai53yA9W5z/D0MDD15qdurr/DxWvHcMbarb0OR
 yMNVxUQIUlPY0uZplu9asPOSElGZ82sM7eWyDzd8shjVQtr9AEoCQOUQ1dm+Xhbh
 BsVkriMNp3cGTJfcZf59+knMDynJBCoOm6+WCPHhtxcOUT0YhBgAVr96m6TDyhCm
 OU+HdxdGS0UdZA5lNo6EKpM6BI6bxS0C28PIDndHhBkMvpqz4MqD2rXB5endib0a
 T0zEu0Xmpy8vtkVx2XUL
 =9bjU
 -----END PGP SIGNATURE-----

Merge tag 'upstream-3.16-rc6' of git://git.infradead.org/linux-ubifs

Pull UBI fixes from Artem Bityutskiy:
 "Two UBI fastmap-related fixes for v3.16:

   - fix UBI fastmap support which we broke in 3.16-rc1 by reversing the
     volumes RB-tree sorting criteria.
   - make sure that we scrub all PEBs where we see bit-flips - we were
     missing some of them when the fastmap feature was enabled"

* tag 'upstream-3.16-rc6' of git://git.infradead.org/linux-ubifs:
  UBI: fastmap: do not miss bit-flips
  UBI: fix the volumes tree sorting criteria
2014-07-18 06:23:34 -10:00
Tomasz Figa
29e697b118 irqchip: gic: Fix core ID calculation when topology is read from DT
Certain GIC implementation, namely those found on earlier, single
cluster, Exynos SoCs, have registers mapped without per-CPU banking,
which means that the driver needs to use different offset for each CPU.

Currently the driver calculates the offset by multiplying value returned
by cpu_logical_map() by CPU offset parsed from DT. This is correct when
CPU topology is not specified in DT and aforementioned function returns
core ID alone. However when DT contains CPU topology, the function
changes to return cluster ID as well, which is non-zero on mentioned
SoCs and so breaks the calculation in GIC driver.

This patch fixes this by masking out cluster ID in CPU offset
calculation so that only core ID is considered. Multi-cluster Exynos
SoCs already have banked GIC implementations, so this simple fix should
be enough.

Reported-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reported-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Tomasz Figa <t.figa@samsung.com>
Fixes: db0d4db22a ("ARM: gic: allow GIC to support non-banked setups")
Cc: <stable@vger.kernel.org> # v3.3+
Link: https://lkml.kernel.org/r/1405610624-18722-1-git-send-email-t.figa@samsung.com
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
2014-07-18 13:13:41 +00:00
Dexuan Cui
2ef82d24f4 Drivers: hv: hv_fcopy: fix a race condition for SMP guest
We should schedule the 5s "timer work" before starting the data transfer,
otherwise, the data transfer code may finish so fast on another
virtual cpu that when the code(fcopy_write()) trying to cancel the 5s
"timer work" can occasionally fail because the "timer work" may haven't
been scheduled yet and as a result the fcopy process will be aborted
wrongly by fcopy_work_func() in 5s.

Thank Liz Zhang <lizzha@microsoft.com> for the initial investigation
on the bug.

This addresses https://bugzilla.redhat.com/show_bug.cgi?id=1118123

Tested-by: Liz Zhang <lizzha@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-17 18:43:10 -07:00
Rafael J. Wysocki
3962808023 Merge branches 'pm-sleep' and 'pm-cpufreq'
* pm-sleep:
  PM / sleep: fix freeze_ops NULL pointer dereferences
  PM / sleep: Fix request_firmware() error at resume

* pm-cpufreq:
  cpufreq: make table sentinel macros unsigned to match use
  cpufreq: move policy kobj to policy->cpu at resume
  cpufreq: cpu0: OPPs can be populated at runtime
  cpufreq: kirkwood: Reinstate cpufreq driver for ARCH_KIRKWOOD
  cpufreq: imx6q: Select PM_OPP
  cpufreq: sa1110: set memory type for h3600
2014-07-18 02:57:30 +02:00
Gavin Guo
bb86cf569b usb: Check if port status is equal to RxDetect
When using USB 3.0 pen drive with the [AMD] FCH USB XHCI Controller
[1022:7814], the second hotplugging will experience the USB 3.0 pen
drive is recognized as high-speed device. After bisecting the kernel,
I found the commit number 41e7e056cd
(USB: Allow USB 3.0 ports to be disabled.) causes the bug. After doing
some experiments, the bug can be fixed by avoiding executing the function
hub_usb3_port_disable(). Because the port status with [AMD] FCH USB
XHCI Controlleris [1022:7814] is already in RxDetect
(I tried printing out the port status before setting to Disabled state),
it's reasonable to check the port status before really executing
hub_usb3_port_disable().

Fixes: 41e7e056cd (USB: Allow USB 3.0 ports to be disabled.)
Signed-off-by: Gavin Guo <gavin.guo@canonical.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-17 17:14:01 -07:00
Dave Airlie
3c169e5629 Merge branch 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
A few more fixes for 3.16.  The pageflipping fixes I dropped last week
have finally shaped up so this is mostly fixes for fallout from the
pageflipping code changes.  Also fix a memory leak and a black screen
when restoring the backlight on console unblanking.

* 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: Make classic pageflip completion path less racy.
  drm/radeon: Add missing vblank_put in pageflip ioctl error path.
  drm/radeon: Remove redundant fence unref in pageflip path.
  drm/radeon: Complete page flip even if waiting on the BO fence fails
  drm/radeon: Move pinning the BO back to radeon_crtc_page_flip()
  drm/radeon: Prevent too early kms-pageflips triggered by vblank.
  drm/radeon: set default bl level to something reasonable
  drm/radeon: avoid leaking edid data
2014-07-18 09:59:21 +10:00
Abbas Raza
953c664697 usb: chipidea: udc: Disable auto ZLP generation on ep0
There are 2 methods for ZLP (zero-length packet) generation:
1) In software
2) Automatic generation by device controller

1) is implemented in UDC driver and it attaches ZLP to IN packet if
   descriptor->size < wLength
2) can be enabled/disabled by setting ZLT bit in the QH

When gadget ffs is connected to ubuntu host, the host sends
get descriptor request and wLength in setup packet is 255 while the
size of descriptor which will be sent by gadget in IN packet is
64 byte. So the composite driver sets req->zero = 1.
In UDC driver following code will be executed then

        if (hwreq->req.zero && hwreq->req.length
            && (hwreq->req.length % hwep->ep.maxpacket == 0))
                add_td_to_list(hwep, hwreq, 0);

Case-A:
So in case of ubuntu host, UDC driver will attach a ZLP to the IN packet.
ubuntu host will request 255 byte in IN request, gadget will send 64 byte
with ZLP and host will come to know that there is no more data.
But hold on, by default ZLT=0 for endpoint 0 so hardware also tries to
automatically generate the ZLP which blocks enumeration for ~6 seconds due
to endpoint 0 STALL, NAKs are sent to host for any requests (OUT/PING)

Case-B:
In case when gadget ffs is connected to Apple device, Apple device sends
setup packet with wLength=64. So descriptor->size = 64 and wLength=64
therefore req->zero = 0 and UDC driver will not attach any ZLP to the
IN packet. Apple device requests 64 bytes, gets 64 bytes and doesn't
further request for IN data. But ZLT=0 by default for endpoint 0 so
hardware tries to automatically generate the ZLP which blocks enumeration
for ~6 seconds due to endpoint 0 STALL, NAKs are sent to host for any
requests (OUT/PING)

According to USB2.0 specs:

    8.5.3.2 Variable-length Data Stage
    A control pipe may have a variable-length data phase in which the
    host requests more data than is contained in the specified data
    structure. When all of the data structure is returned to the host,
    the function should indicate that the Data stage is ended by
    returning a packet that is shorter than the MaxPacketSize for the
    pipe. If the data structure is an exact multiple of wMaxPacketSize
    for the pipe, the function will return a zero-length packet to indicate
    the end of the Data stage.

In Case-A mentioned above:
If we disable software ZLP generation & ZLT=0 for endpoint 0 OR if software
ZLP generation is not disabled but we set ZLT=1 for endpoint 0 then
enumeration doesn't block for 6 seconds.

In Case-B mentioned above:
If we disable software ZLP generation & ZLT=0 for endpoint then enumeration
still blocks due to ZLP automatically generated by hardware and host not needing
it. But if we keep software ZLP generation enabled but we set ZLT=1 for
endpoint 0 then enumeration doesn't block for 6 seconds.

So the proper solution for this issue seems to disable automatic ZLP generation
by hardware (i.e by setting ZLT=1 for endpoint 0) and let software (UDC driver)
handle the ZLP generation based on req->zero field.

Cc: stable@vger.kernel.org
Signed-off-by: Abbas Raza <Abbas_Raza@mentor.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-07-17 16:51:22 -07:00
Bjørn Mork
c2a6c7813f net: huawei_cdc_ncm: add "subclass 3" devices
Huawei's usage of the subclass and protocol fields is not 100%
clear to us, but there appears to be a very strict system.

A device with the "shared" device ID 12d1:1506 and this NCM
function was recently reported (showing only default altsetting):

    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      3
      bInterfaceProtocol     22
      iInterface              8 CDC Network Control Model (NCM)
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  06 24 1a 00 01 1f
      ** UNRECOGNIZED:  0c 24 1b 00 01 00 04 10 14 dc 05 20
      ** UNRECOGNIZED:  0d 24 0f 0a 0f 00 00 00 ea 05 03 00 01
      ** UNRECOGNIZED:  05 24 06 01 01
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               9

Cc: Enrico Mioso <mrkiko.rs@gmail.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-17 16:49:50 -07:00
Bjørn Mork
5343330010 net: qmi_wwan: add two Sierra Wireless/Netgear devices
Add two device IDs found in an out-of-tree driver downloadable
from Netgear.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-17 16:49:50 -07:00
Dan Carpenter
a28d0e873d wan/x25_asy: integer overflow in x25_asy_change_mtu()
If "newmtu * 2 + 4" is too large then it can cause an integer overflow
leading to memory corruption.  Eric Dumazet suggests that 65534 is a
reasonable upper limit.

Btw, "newmtu" is not allowed to be a negative number because of the
check in dev_set_mtu(), so that's ok.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-17 16:47:50 -07:00
James Bottomley
89fb4cd1f7 scsi: handle flush errors properly
Flush commands don't transfer data and thus need to be special cased
in the I/O completion handler so that we can propagate errors to
the block layer and filesystem.

Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Reported-by: Steven Haber <steven@qumulo.com>
Tested-by: Steven Haber <steven@qumulo.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Hellwig <hch@lst.de>
2014-07-17 21:56:34 +02:00
Linus Torvalds
59ca9ee428 Fixes:
- Fixes console deadlock when resuming PV guests
  - Fix regression hit when ballooning and resuming PV guests
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJTxt1pAAoJEFjIrFwIi8fJbGcH/RW88DhFw3wJrtyd68R2uY4R
 BQVsUeXltzS7cRZ46ytStn+UveXOII9SI1kdU0yAPWbpzgKwXkXLTGUbL26vXmfq
 ZpAGIVFBG+SrHuTDEYP/IhB2TI6ugTeHVK8+Mo+HfjEs99OJ+BAf4IlZ9cLUvrW8
 l51HcFe7c9ueH7YculTAesUWZrdS6p5FBbTz0pwG8BvU5NxJ2EC+MktLEKZmV27Q
 Y3CN///BhIN6YXhPA3Frykxs36m4gFJUPgXbEQFea79I67f+frBX/VdKNPeaMoaR
 yb305PStdxwo6Ja8Qx/CrTl+y8vTtLP1cADRGSdLD3m1vI42PNF4Qjr1ruLbA34=
 =ky5L
 -----END PGP SIGNATURE-----

Merge tag 'stable/for-linus-3.16-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull Xen fixes from Konrad Rzeszutek Wilk:
 "Two fixes found during migration of PV guests.  David would be the one
  doing this pull but he is on vacation.

  Fixes:
   - fix console deadlock when resuming PV guests
   - fix regression hit when ballooning and resuming PV guests"

* tag 'stable/for-linus-3.16-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/balloon: set ballooned out pages as invalid in p2m
  xen/manage: fix potential deadlock when resuming the console
2014-07-17 08:02:35 -10:00
Mario Kleiner
5f87e090a7 drm/radeon: Make classic pageflip completion path less racy.
Need to protect mmio flip programming by event lock as well.

Need to also first enable pflip irq, then mmio program,
otherwise a flip completion may get unnoticed in the vblank
of actual completion if the flip is programmed, but
radeon_flip_work_func gets preempted immediately after
mmio programming and before vblank. In that case the
vblank irq handler wouldn't run radeon_crtc_handle_vblank()
with the completion check routine, miss the completed flip,
and only notice one vblank after actual completion, causing
a false/delayed report of flip completion.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-17 09:04:03 -04:00
Mario Kleiner
826484977c drm/radeon: Add missing vblank_put in pageflip ioctl error path.
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-17 09:03:57 -04:00
Mario Kleiner
c89e5be621 drm/radeon: Remove redundant fence unref in pageflip path.
Not needed anymore, as it is already unreffed within
radeon_flip_work_func() after its only use.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-17 09:03:40 -04:00
Michel Dänzer
306f98d9a1 drm/radeon: Complete page flip even if waiting on the BO fence fails
Otherwise the DRM core and userspace will be confused about which BO the
CRTC is scanning out.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-17 09:01:32 -04:00
Michel Dänzer
c60381bd82 drm/radeon: Move pinning the BO back to radeon_crtc_page_flip()
As well as enabling the vblank interrupt. These shouldn't take any
significant amount of time, but at least pinning the BO has actually been
seen to fail in practice before, in which case we need to let userspace
know about it.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-17 09:01:31 -04:00
Mario Kleiner
f53f81b257 drm/radeon: Prevent too early kms-pageflips triggered by vblank.
Since 3.16-rc1 we have this new failure:

When the userspace XOrg ddx schedules vblank events to
trigger deferred kms-pageflips, e.g., via the OML_sync_control
extension call glXSwapBuffersMscOML(), or if a glXSwapBuffers()
is called immediately after completion of a previous swapbuffers
call, e.g., in a tight rendering loop with minimal rendering,
it happens frequently that the pageflip ioctl() is executed
within the same vblank in which a previous kms-pageflip completed,
or - for deferred swaps - always one vblank earlier than requested
by the client app.

This causes premature pageflips and detection of failure by
the ddx, e.g., XOrg log warnings like...

"(WW) RADEON(1): radeon_dri2_flip_event_handler: Pageflip
completion event has impossible msc 201025 < target_msc 201026"

... and error/invalid return values of glXWaitForSbcOML() and
Intel_swap_events extension.

Reason is the new way in which kms-pageflips are programmed
since 3.16.

This commit changes the time window in which the hw can
execute pending programmed pageflips. Before, a pending flip
would get executed anywhere within the vblank interval. Now
a pending flip only gets executed at the leading edge of
vblank (start of front porch), making sure that a invocation
of the pageflip ioctl() within a given vblank interval will
only lead to pageflip completion in the following vblank.

Tested to death on a DCE-4 card.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2014-07-17 09:01:31 -04:00
Alex Deucher
201bb62402 drm/radeon: set default bl level to something reasonable
If the value in the scratch register is 0, set it to the
max level.  This fixes an issue where the console fb blanking
code calls back into the backlight driver on unblank and then
sets the backlight level to 0 after the driver has already
set the mode and enabled the backlight.

bugs:
https://bugs.freedesktop.org/show_bug.cgi?id=81382
https://bugs.freedesktop.org/show_bug.cgi?id=70207

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Tested-by: David Heidelberger <david.heidelberger@ixit.cz>
Cc: stable@vger.kernel.org
2014-07-17 09:01:30 -04:00
Alex Deucher
0ac66effe7 drm/radeon: avoid leaking edid data
In some cases we fetch the edid in the detect() callback
in order to determine what sort of monitor is connected.
If that happens, don't fetch the edid again in the get_modes()
callback or we will leak the edid.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
2014-07-17 09:01:29 -04:00
Suravee Suthikulpanit
144cb08864 irqchip: gic: Add binding probe for ARM GIC400
Commit 3ab72f9156 "dt-bindings: add GIC-400 binding" added the
"arm,gic-400" compatible string, but the corresponding IRQCHIP_DECLARE
was never added to the gic driver.

Therefore add the missing irqchip declaration for it.

Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>

Removed additional empty line and adapted commit message to mark it
as fixing an issue.
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Will Deacon <will.deacon@arm.com>
Fixes: 3ab72f9156 ("dt-bindings: add GIC-400 binding")
Cc: <stable@vger.kernel.org> # v3.14+
Link: https://lkml.kernel.org/r/2621565.f5eISveXXJ@diego
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
2014-07-17 12:46:07 +00:00
Andrey Utkin
a2a9e02b5b drivers/ata/pata_ep93xx.c: use signed int type for result of platform_get_irq()
[linux-3.16-rc5/drivers/ata/pata_ep93xx.c:929]: (style) Checking if unsigned
variable 'irq' is less than zero.

Source code is

    irq = platform_get_irq(pdev, 0);
    if (irq < 0) {

but

    unsigned int irq;

$ fgrep platform_get_irq `find . -name \*.h -print`
./include/linux/platform_device.h:extern int platform_get_irq(struct
platform_device *, unsigned int);

Now using "int" type instead of "unsigned int" for "irq" variable.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=80401
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2014-07-17 08:36:13 -04:00
Viresh Kumar
92c14bd947 cpufreq: move policy kobj to policy->cpu at resume
This is only relevant to implementations with multiple clusters, where clusters
have separate clock lines but all CPUs within a cluster share it.

Consider a dual cluster platform with 2 cores per cluster. During suspend we
start hot unplugging CPUs in order 1 to 3. When CPU2 is removed, policy->kobj
would be moved to CPU3 and when CPU3 goes down we wouldn't free policy or its
kobj as we want to retain permissions/values/etc.

Now on resume, we will get CPU2 before CPU3 and will call __cpufreq_add_dev().
We will recover the old policy and update policy->cpu from 3 to 2 from
update_policy_cpu().

But the kobj is still tied to CPU3 and isn't moved to CPU2. We wouldn't create a
link for CPU2, but would try that for CPU3 while bringing it online. Which will
report errors as CPU3 already has kobj assigned to it.

This bug got introduced with commit 42f921a, which overlooked this scenario.

To fix this, lets move kobj to the new policy->cpu while bringing first CPU of a
cluster back. Also do a WARN_ON() if kobject_move failed, as we would reach here
only for the first CPU of a non-boot cluster. And we can't recover from this
situation, if kobject_move() fails.

Fixes: 42f921a6f1 (cpufreq: remove sysfs files for CPUs which failed to come back after resume)
Cc:  3.13+ <stable@vger.kernel.org> # 3.13+
Reported-and-tested-by: Bu Yitian <ybu@qti.qualcomm.com>
Reported-by: Saravana Kannan <skannan@codeaurora.org>
Reviewed-by: Srivatsa S. Bhat <srivatsa@mit.edu>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-17 14:23:22 +02:00
Christoph Schulz
cc25eaae23 net: ppp: fix creating PPP pass and active filters
Commit 568f194e8b ("net: ppp: use
sk_unattached_filter api") inadvertently changed the logic when setting
PPP pass and active filters. This applies to both the generic PPP subsystem
implemented by drivers/net/ppp/ppp_generic.c and the ISDN PPP subsystem
implemented by drivers/isdn/i4l/isdn_ppp.c. The original code in ppp_ioctl()
(or isdn_ppp_ioctl(), resp.) handling PPPIOCSPASS and PPPIOCSACTIVE allowed to
remove a pass/active filter previously set by using a filter of length zero.
However, with the new code this is not possible anymore as this case is not
explicitly checked for, which leads to passing NULL as a filter to
sk_unattached_filter_create(). This results in returning EINVAL to the caller.

Additionally, the variables ppp->pass_filter and ppp->active_filter (or
is->pass_filter and is->active_filter, resp.) are not reset to NULL, although
the filters they point to may have been destroyed by
sk_unattached_filter_destroy(), so in this EINVAL case dangling pointers are
left behind (provided the pointers were previously non-NULL).

This patch corrects both problems by checking whether the filter passed is
empty or non-empty, and prevents sk_unattached_filter_create() from being
called in the first case. Moreover, the pointers are always reset to NULL
as soon as sk_unattached_filter_destroy() returns.

Signed-off-by: Christoph Schulz <develop@kristov.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-16 23:42:06 -07:00
Amir Vadai
858e6c3210 net/mlx4_en: cq->irq_desc wasn't set in legacy EQ's
Fix a regression introduced by commit 35f6f45 ("net/mlx4_en: Don't use
irq_affinity_notifier to track changes in IRQ affinity map").
When core is started in legacy EQ's (number of IRQ's < rx rings), cq->irq_desc
was NULL.  This caused a kernel crash under heavy traffic - when having more
than rx NAPI budget completions.
Fixed to have it set for both EQ modes.

Signed-off-by: Amir Vadai <amirv@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-16 23:28:32 -07:00
Roland Dreier
56c5333cfc Merge branches 'cxgb4' and 'mlx5' into for-next 2014-07-16 23:14:42 -07:00
Or Gerlitz
652c1a0517 IB/mlx5: Enable "block multicast loopback" for kernel consumers
In commit f360d88a2e, we advertise blocking multicast loopback to both
kernel and userspace consumers, but don't allow kernel consumers (e.g IPoIB)
to use it with their UD QPs.  Fix that.

Fixes: f360d88a2e ("IB/mlx5: Add block multicast loopback support")
Reported-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
2014-07-16 23:14:26 -07:00
Sowmini Varadhan
a4b70a07ed sunvnet: clean up objects created in vnet_new() on vnet_exit()
Nothing cleans up the objects created by
vnet_new(), they are completely leaked.

vnet_exit(), after doing the vio_unregister_driver() to clean
up ports, should call a helper function that iterates over vnet_list
and cleans up those objects. This includes unregister_netdevice()
as well as free_netdev().

Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Reviewed-by: Karl Volz <karl.volz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-16 22:44:07 -07:00
Michel Dänzer
7a9810e7bd r8169: Enable RX_MULTI_EN for RTL_GIGA_MAC_VER_40
The ethernet port on my ASUS A88X Pro mainboard stopped working
several times a day, with messages like these in dmesg:

AMD-Vi: Event logged [IO_PAGE_FAULT device=05:00.0 domain=0x001e address=0x0000000000003000 flags=0x0050]

Searching the web for these messages led me to similar reports about
different hardware supported by r8169, and eventually to commits
3ced8c955e ('r8169: enforce RX_MULTI_EN
for the 8168f.') and eb2dc35d99 ('r8169:
RxConfig hack for the 8168evl'). So I tried this change, and it fixes
the problem for me.

Signed-off-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-16 22:23:55 -07:00
Guenter Roeck
de12d6f4b1 hwmon: (adt7470) Fix writes to temperature limit registers
Temperature limit registers are signed. Limits therefore need
to be clamped to (-128, 127) degrees C and not to (0, 255)
degrees C.

Without this fix, writing a limit of 128 degrees C sets the
actual limit to -128 degrees C.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable@vger.kernel.org
Reviewed-by: Axel Lin <axel.lin@ingics.com>
2014-07-16 21:18:47 -07:00
Jason Wang
fbb60fe35a drm/qxl: return IRQ_NONE if it was not our irq
Return IRQ_NONE if it was not our irq. This is necessary for the case
when qxl is sharing irq line with a device A in a crash kernel. If qxl
is initialized before A and A's irq was raised during this gap,
returning IRQ_HANDLED in this case will cause this irq to be raised
again after EOI since kernel think it was handled but in fact it was
not.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2014-07-17 08:08:06 +10:00
Linus Torvalds
b6603fe574 MTD updates for 3.16-rc6
- Fix ELM suspend/resume
 - Reduce warnings if NAND ECC is too weak
 - Add CFI support for Sharp LH28F640BF NOR
 
 The last fix is coming in because other commits in the 3.16 cycle depended on
 this support.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTxrg9AAoJEFySrpd9RFgtJvMP/1xlHR4Pb8uJnTPFwDZbR6CQ
 0I9q7K0wgvdtlTXLKqbmOEVZ7yn6EVpx/TR9Pdk+aCvJFrnKjkiTenZ7yeT80iad
 lOp4zWf2+x74zMn9Q2m16YAoL/AwoGoiP5iaMnD+vwkwf2kzr7QbgxO/YqwtCv0O
 gY/eAPiCWzlKlswEavSVBj//eqSdHWn4imKDisZ0roDYw8J+T3n42gwnVoqp5MqU
 mrk0N/hpuxaYA4TH3XFhDb/QgfKSsNt/c3FzeQKO+aurwfM7TuuKVOGYdT/URuhg
 oSLCRBoVF9EIUVIDeEWxmktJJx8HRCpmoLZE7jj8g/y9I6P4JZk73KTMIEdE9170
 x9j7jYngp68yKw9wel6zcTPpEzzHzyenJKlUqUjwhsxemfdXjDOp+X+QlI8MGvuL
 kypLN8xnIMYhSpFhOq0W+Emi67CXi9uN83HMZV4nP9krZDHb796pi1iRX66Vdl61
 1U9dJ2YZy4mSoDQXS8bo98yR9Qw/UDA+Fus+OOfnGtTxcMYF2rdmL5sCMNBvAK+1
 fpkSJDnNrmaa6zvSrKm6JOk5UTEFvmXZocBcrwIzMG3jI+JsZ9jwY7kpUA25Dz5b
 wowABmfnjmuazsI8Ga9zGUjl70vHV/VuVYYSZybMxGdHxYKmdXJ1kSDqtuSlSQ3A
 +KxZd8I/mdnOAy/OWIsd
 =OGTK
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-20140716' of git://git.infradead.org/linux-mtd

Pull MTD fixes from Brian Norris:

 - Fix ELM suspend/resume

 - Reduce warnings if NAND ECC is too weak

 - Add CFI support for Sharp LH28F640BF NOR

   The last fix is coming in because other commits in the 3.16 cycle
   depended on this support.

* tag 'for-linus-20140716' of git://git.infradead.org/linux-mtd:
  mtd: cfi_cmdset_0001.c: add support for Sharp LH28F640BF NOR
  mtd: nand: reduce the warning noise when the ECC is too weak
  mtd: devices: elm: fix elm_context_save() and elm_context_restore() functions
2014-07-16 10:11:42 -10:00
Viresh Kumar
1bf8cc3d01 cpufreq: cpu0: OPPs can be populated at runtime
OPPs can be populated statically, via DT, or added at run time with
dev_pm_opp_add().

While this driver handles the first case correctly, it would fail to populate
OPPs added at runtime. Because call to of_init_opp_table() would fail as there
are no OPPs in DT and probe will return early.

To fix this, remove error checking and call dev_pm_opp_init_cpufreq_table()
unconditionally.

Update bindings as well.

Suggested-by: Stephen Boyd <sboyd@codeaurora.org>
Tested-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-16 15:12:52 +02:00
Quentin Armitage
2fa1adc070 cpufreq: kirkwood: Reinstate cpufreq driver for ARCH_KIRKWOOD
Commit ff1f0018cf ("drivers: Enable
building of Kirkwood drivers for mach-mvebu") added Kirkwood into
mach-mvebu, adding MACH_KIRKWOOD to ARCH_KIRKWOOD in the KConfig files.

The change for ARM_KIRKWOOD_CPUFREQ replaced ARCH_KIRKWOOD with
MACH_KIRKWOOD, whereas all the other changes were ARCH_KIRKWOOD ||
MACH_KIRKWOOD.

As a consequence of this change, the cpufreq driver is no longer enabled
for ARCH_KIRKWOOD. This patch reinstates ARM_KIRKWOOD_CPUFREQ for
ARCH_KIRKWOOD.

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
Acked-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-16 15:12:03 +02:00
Nicolas Del Piano
7e02168711 cpufreq: imx6q: Select PM_OPP
PM_OPP is a library used by several of the existing cpufreq drivers.
ARM IMX6Q cpufreq driver uses this library for its functionality.
Thus, it should be selected in Kconfig.

Reported-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Nicolas Del Piano <ndel314@gmail.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-16 14:45:37 +02:00
Linus Walleij
97d496bf1a cpufreq: sa1110: set memory type for h3600
The Compaq iPAQ h3600 also has the K4S281632b-1H memory type.
Verified by prying apart a broken board.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-16 14:30:17 +02:00
Hans de Goede
4cf465b579 ACPI / video: Add use_native_backlight quirk for HP ProBook 4540s
As reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1025690
This is yet another model which needs this quirk.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1025690
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2014-07-16 14:16:30 +02:00
Ingo Tuchscherer
666e68e0dd s390/zcrypt: improve device probing for zcrypt adapter cards
Improve device probing process for zcrypt adapters to
transmit service request during registration process.

Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2014-07-16 10:48:12 +02:00
Martin Schwidefsky
7cbe4afe85 s390/3270: correct size detection with the read-partition command
The size detection for 3270 terminals with the read-partition command is
broken. The raw3270_reset_device_cb function clears the init_data array,
but if raw3270_writesf_readpart has been called the read-partition command
is queued which needs the init_data array. In this case the size detection
will fail and the invalid command does funny things to the terminal.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
2014-07-16 10:48:10 +02:00
Brian Norris
44305ebde2 UBI: fastmap: do not miss bit-flips
The return value from 'ubi_io_read_ec_hdr()' was stored in 'err', not in 'ret'.
This fix makes sure Fastmap-enabled UBI does not miss bit-flip while reading EC
headers, events and scrubs the affected PEBs.

This issue was reported by Coverity Scan.

Artem: improved the commit message.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
2014-07-16 08:32:00 +03:00
Linus Torvalds
d7b6e53e32 A GPIO fix for the v3.16 series - fixes up some merge
confusion from the merge window.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQIcBAABAgAGBQJTxXoGAAoJEEEQszewGV1z6ogQAIIe+juP1FUjRdsZkD8S6ewF
 gdtOSMuPfL3HV+hSlRLKchAQbA+4HMxyH9lv0Vd8CHKy91w932w6x84O10B1XQJf
 ethsxxXmMi7OGTMQkIrbuZZDcnOVkcNmw1GuPXknvHUWgNFDUMz6nu0YShQ+ZehQ
 ctIAyfV0wdFilZHuSkO+thj/+cDjBEjlklgAcVVQ6OgnmshPDd1PmELzVbKIueWf
 E+/KgyLYvunubcuYB56dfDWtG4pE48qVekvDzXHZXxVQbuW3Ov4fOzQvyO01s/WQ
 cK7S7T5T3FepYzWIvh5fvGIXKfoD6sjdQWQ4hUBYTZI+qpdoN7Diri3T1Rhe4avj
 lJ5xCZujJ3AnFSEowqn9oM0CQQ5J0Dx3joUYnL+Krkt+va+LayrRwWxdMmoCX57H
 2uw3uAVdAg4qhqHcxJP7HnsgXEocDVKcGXV59++wdE8Ebann3IeyH4MnDCr2hQM+
 u0O1IgjjZlOM0NAfGySCcTsfUxW4mB8znAOex+66PnX1Mvncm0UVc+VrkAxcYp3Q
 3Ek7hz6sIPB/b8RYzPb5X4aT+lXZyD8I8lOE7OruxhWggCC3cnCDQWRJQ+DNvwYJ
 z3GiPLJRgFuvoF7QrYhOeBlUH3fZ9mrqLQietQiAS1tz0oMKYO4TBkM8HDjLMNAx
 3hQEuyp9EHDA9K1gxERL
 =h0US
 -----END PGP SIGNATURE-----

Merge tag 'gpio-v3.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fix from Linus Walleij:
 "Fix up some merge confusion from the merge window"

* tag 'gpio-v3.16-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: mcp23s08: Eliminates redundant checking.
2014-07-15 17:46:51 -10:00
Laurent Pinchart
fe132649b5 gpio: rcar: Add support for DT IRQ flags
The gpio-rcar driver has no IRQ domain OF xlate function and thus
ignores IRQ flags specified in DT. Fix this by using the two-cell xlate
function.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2014-07-15 20:55:15 +02:00
Maxime COQUELIN
7a2deccf0e pinctrl: st: Fix irqmux handler
st_gpio_irqmux_handler() reads the status register to find out
which banks inside the controller have pending IRQs.
For each banks having pending IRQs, it calls the corresponding handler.

Problem is that current code restricts the number of possible banks inside the
controller to ST_GPIO_PINS_PER_BANK. This define represents the number of pins
inside a bank, so it shouldn't be used here.

On STiH407, PIO_FRONT0 controller has 10 banks, so IRQs pending in the two
last banks (PIO18 & PIO19) aren't handled.

This patch replace ST_GPIO_PINS_PER_BANK by the number of banks inside the
controller.

Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: <stable@vger.kernel.org> #v3.15+
Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Maxime Coquelin <maxime.coquelin@st.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2014-07-15 20:55:15 +02:00
Mike Snitzer
048e5a07f2 dm cache metadata: do not allow the data block size to change
The block size for the dm-cache's data device must remained fixed for
the life of the cache.  Disallow any attempt to change the cache's data
block size.

Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <ejt@redhat.com>
Cc: stable@vger.kernel.org
2014-07-15 14:07:50 -04:00
Mike Snitzer
9aec8629ec dm thin metadata: do not allow the data block size to change
The block size for the thin-pool's data device must remained fixed for
the life of the thin-pool.  Disallow any attempt to change the
thin-pool's data block size.

It should be noted that attempting to change the data block size via
thin-pool table reload will be ignored as a side-effect of the thin-pool
handover that the thin-pool target does during thin-pool table reload.

Here is an example outcome of attempting to load a thin-pool table that
reduced the thin-pool's data block size from 1024K to 512K.

Before:
kernel: device-mapper: thin: 253:4: growing the data device from 204800 to 409600 blocks

After:
kernel: device-mapper: thin metadata: changing the data block size (from 2048 to 1024) is not supported
kernel: device-mapper: table: 253:4: thin-pool: Error creating metadata object
kernel: device-mapper: ioctl: error adding target to table

Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <ejt@redhat.com>
Cc: stable@vger.kernel.org
2014-07-15 14:05:26 -04:00
Linus Torvalds
5615f9f822 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:

 1) Bluetooth pairing fixes from Johan Hedberg.

 2) ieee80211_send_auth() doesn't allocate enough tail room for the SKB,
    from Max Stepanov.

 3) New iwlwifi chip IDs, from Oren Givon.

 4) bnx2x driver reads wrong PCI config space MSI register, from Yijing
    Wang.

 5) IPV6 MLD Query validation isn't strong enough, from Hangbin Liu.

 6) Fix double SKB free in openvswitch, from Andy Zhou.

 7) Fix sk_dst_set() being racey with UDP sockets, leading to strange
    crashes, from Eric Dumazet.

 8) Interpret the NAPI budget correctly in the new systemport driver,
    from Florian Fainelli.

 9) VLAN code frees percpu stats in the wrong place, leading to crashes
    in the get stats handler.  From Eric Dumazet.

10) TCP sockets doing a repair can crash with a divide by zero, because
    we invoke tcp_push() with an MSS value of zero.  Just skip that part
    of the sendmsg paths in repair mode.  From Christoph Paasch.

11) IRQ affinity bug fixes in mlx4 driver from Amir Vadai.

12) Don't ignore path MTU icmp messages with a zero mtu, machines out
    there still spit them out, and all of our per-protocol handlers for
    PMTU can cope with it just fine.  From Edward Allcutt.

13) Some NETDEV_CHANGE notifier invocations were not passing in the
    correct kind of cookie as the argument, from Loic Prylli.

14) Fix crashes in long multicast/broadcast reassembly, from Jon Paul
    Maloy.

15) ip_tunnel_lookup() doesn't interpret wildcard keys correctly, fix
    from Dmitry Popov.

16) Fix skb->sk assigned without taking a reference to 'sk' in
    appletalk, from Andrey Utkin.

17) Fix some info leaks in ULP event signalling to userspace in SCTP,
    from Daniel Borkmann.

18) Fix deadlocks in HSO driver, from Olivier Sobrie.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (93 commits)
  hso: fix deadlock when receiving bursts of data
  hso: remove unused workqueue
  net: ppp: don't call sk_chk_filter twice
  mlx4: mark napi id for gro_skb
  bonding: fix ad_select module param check
  net: pppoe: use correct channel MTU when using Multilink PPP
  neigh: sysctl - simplify address calculation of gc_* variables
  net: sctp: fix information leaks in ulpevent layer
  MAINTAINERS: update r8169 maintainer
  net: bcmgenet: fix RGMII_MODE_EN bit
  tipc: clear 'next'-pointer of message fragments before reassembly
  r8152: fix r8152_csum_workaround function
  be2net: set EQ DB clear-intr bit in be_open()
  GRE: enable offloads for GRE
  farsync: fix invalid memory accesses in fst_add_one() and fst_init_card()
  igb: do a reset on SR-IOV re-init if device is down
  igb: Workaround for i210 Errata 25: Slow System Clock
  usbnet: smsc95xx: add reset_resume function with reset operation
  dp83640: Always decode received status frames
  r8169: disable L23
  ...
2014-07-15 08:42:52 -07:00
Alexey Asemov
eec7e1c16d libata: EH should handle AMNF error condition as a media error
libata-eh.c should handle AMNF error condition (error byte bit 0,
usually code 0x01) in libata-eh.c along with UNC as a media error so
SCSI stack can handle it properly (translation code 0x01 is already
present in libata-scsi.c) but was never passed down due to lack of
handling in EH.

While using linux-based machine (AMD 6550M-based notebook, PCI IDs for the
controller are 1022:7801 subsys 1025:059d) and ddrescue to salvage data
from failing hard drive (WD7500BPVT 2.5" 750G SATA2), I've found that pure
AMNF 0x01 error code generates generic "device error" that is retried
several times by SCSI stack instead of "media error" that is passed up to
software.

So we may assume deprecated AMNF error code is surely not dead yet, and
it's better for it to be handled properly. As we may see it is used by
modern enough devices, and used properly: drive returned AMNF only when IDs
for track cannot be read completely due to dying head or positioning,
otherwise it returned UNC(orrectables).

Not handling it causes wrong generic error code ("device error") reporting
down the stack, can damage failing drives further because of excessive
retries, and slows salvaging down a lot. Also, there is handling code in
libata-scsi.c for 0x01 AMNF error already.

https://bugzilla.kernel.org/show_bug.cgi?id=80031

tj: Shortened $SUBJ and moved its content to the first paragraph.

Signed-off-by: Alexey Asemov <alex@alex-at.ru>
Signed-off-by: Tejun Heo <tj@kernel.org>
2014-07-15 11:13:57 -04:00
Dave Airlie
85d9e14cfd Merge branch 'linux-3.16' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes
deadlock fix.

* 'linux-3.16' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau/therm: fix a potential deadlock in the therm monitoring code
2014-07-15 13:25:58 +10:00
Martin Peres
bb78e7a12a drm/nouveau/therm: fix a potential deadlock in the therm monitoring code
Signed-off-by: Martin Peres <martin.peres@free.fr>
Tested-by: Stefan Ringel <mail@stefanringel.de>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
2014-07-15 12:33:00 +10:00
Olivier Sobrie
8f9818af4e hso: fix deadlock when receiving bursts of data
When the module sends bursts of data, sometimes a deadlock happens in
the hso driver when the tty buffer doesn't get the chance to be flushed
quickly enough.

Remove the endless while loop in function put_rxbuf_data() which is
called by the urb completion handler.
If there isn't enough room in the tty buffer, discards all the data
received in the URB.

Cc: David Miller <davem@davemloft.net>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Jan Dumon <j.dumon@option.com>
Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-14 19:27:34 -07:00
Olivier Sobrie
5c763edfe4 hso: remove unused workqueue
The workqueue "retry_unthrottle_workqueue" is not scheduled anywhere
in the code. So, remove it.

Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-07-14 19:27:34 -07:00